test(core): raise identity.ts mutation score - #100
Merged
Merged
Conversation
Nothing previously asserted the constant's actual numeric value, so any operator swap in its 365 * 24 * 60 * 60 * 1000 derivation (e.g. one * becoming /) produced a wrong validity period with every existing test still passing.
Nothing verified the version field encoded as v3 (context tag [0] EXPLICIT INTEGER 2), so a mutation truncating it to an empty INTEGER (effectively v1) went undetected despite the Subject Alternative Name and Basic Constraints extensions being illegal on a v1 certificate. Separately, the DER-INTEGER minimal-padding fix-up for the serial number's leading byte had an unguarded assignment path that forces that byte to a fixed value regardless of its randomly generated content; nothing previously checked that serial numbers actually vary across identities.
Fakes the system clock to a date where every UTCTime component (year mod 100, month, day, minute) is below 10, then checks the certificate's parsed validity window against the exact expected instants. Every existing test ran against the real "now", whose year-mod-100 and month/day/hour/minute happen to already be two digits most of the time, so a missing zero-pad or an inverted getUTCMonth() + 1 went unnoticed as long as no field happened to need padding.
rawPublicKeyFromPrivateKey is exported public API, so a caller can genuinely pass a non-EC private key (RSA, Ed25519) whose JWK export carries no x/y coordinates. Nothing exercised that guard before, so its error message could be mutated to an empty string without any test noticing.
Neither the extension's critical flag nor the certificate body's 64-char line wrapping had any assertion: a flipped critical bit or a one-char-per-line PEM body both still parse and load fine via tls.createServer, so the existing loadability-only checks never noticed either regression.
Mearman
marked this pull request as ready for review
September 14, 2026 07:08
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
🎉 This PR is included in version 2.21.4 🎉 The release is available on: Your semantic-release bot 📦🚀 |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes progress on agent-comms#64 (the
identity.tsslice).Adds regression tests for gaps the Stryker baseline run found in
src/core/identity.ts, raising its mutation score from 77.55% (70 killed, 6 timeout, 22 survived, out of 98 covered mutants) to 92.86% (85 killed, 6 timeout, 7 survived).New tests:
CERTIFICATE_VALIDITY_MSpinned to its exact millisecond value (365 * 24 * 60 * 60 * 1000).[0]EXPLICIT INTEGER 2).notBefore/notAfterchecked against an exact, fully zero-padded date under a faked system clock (year/month/day/minute all single-digit), closing gaps that only show up when a date component needs padding.rawPublicKeyFromPrivateKeythrows for a non-EC private key (RSA) whose JWK export has no x/y coordinates.The remaining 7 survivors are mutants I traced and confirmed are mathematically equivalent given this file's actual call graph, not fixable without a contrived test:
derLength's long-form (0x81) branch: every real DER length in this file's certificate structure is either under 128 bytes or over 256 bytes (TBSCertificate content is a fixed 287 bytes; the outer certificate content is bounded to ~376-378 bytes by ECDSA-P256 signature encoding), so the[128, 255]branch is never reached with a true condition by any real invocation.derIntegerBytes's leading-zero-padding branch: both real callers (the version field'sBuffer.from([2])and the serial number, whose first byte is explicitly masked to[1, 127]before encoding) never produce a byte with the high bit set, so this branch's condition is always false in practice.fingerprintDer's null-match fallback:hex.match(/.{2}/g)on a SHA-256 hex digest (always exactly 64 characters) can never return null — this is a mathematical certainty regardless of input, since 64 is even and the pattern always matches fully.derToCertificatePem'sb64 ?? []fallback: the certificate DER is never empty, soder.toString("base64").match(/.{1,64}/g)never returns null.None of these are reachable through this file's actual, current call graph, so a test built to reach them would be testing hypothetical input the code never receives.
Test plan:
pnpm typecheckpnpm lintpnpm test(full suite, 345 passing)src/core/identity.ts: 92.86% (85 killed, 6 timeout, 7 survived, out of 98 covered)